A Backend & Identity Glossary: JWT, JWKS, Multi-Tenancy, and More

A compact, signed piece of data — usually containing a user ID and some claims about them — that a client presents to prove who it is, without the server needing to look up a session on every request. The signature is what makes it trustworthy: anyone can read a JWT’s contents, but only the holder of the signing key can produce a valid one.

An architecture where a single application instance serves multiple separate customers (“tenants”), with each tenant’s data kept isolated from the others. The isolation can happen at different levels — separate databases, separate schemas, or row-level filtering in a shared database — and which one you pick has real consequences for security and cost.

A JSON document, served at a public URL, listing the public keys a service uses to verify signatures — most commonly for RS256-signed JWTs (see the RS256 vs HS256 post). Any service that needs to verify a token fetches this endpoint instead of being handed the key directly, which is what makes key rotation possible without a coordinated redeploy.

Session auth keeps a record of who’s logged in on the server (usually in a database or an in-memory store) and gives the client an opaque ID that points to it. Token auth (like JWT) puts the actual claims in the token itself, so the server can verify it without a lookup. Sessions are easier to revoke instantly; tokens scale better across multiple services without a shared session store.

A password-hashing algorithm, and the current recommended default for storing passwords. It’s deliberately slow and memory-hungry, which is the point — it makes brute-forcing stolen password hashes expensive. Covered in full, alongside bcrypt and scrypt, in its own post.

Authentication answers “who is this?” — logging in, verifying identity. Authorization answers “what are they allowed to do?” — permissions, roles, access control. A system can authenticate someone correctly and still get authorization wrong, and vice versa; they’re solved by different code paths even though they’re often discussed together.